The privacy laws of Europe

GDPR procedural rules

Regulation on the enforcement of the GDPR in cross-border cases

How regulators handle complaints and investigations that cross borders: deadlines, the right to be heard, access to the file.

2025 Applies from 2 April 2027

Data (Use and Access) Act 2025

Changes the UK GDPR, the Data Protection Act and the cookie rules, and sets up “smart data” schemes.

2025 Coming into force in stages since June 2025

UK GDPR

The GDPR as kept in UK law

The GDPR as it stayed in UK law after Brexit, enforced by the Information Commissioner’s Office (ICO).

2021 UK law since 1 January 2021

EUDPR

Data protection rules for the EU institutions

The GDPR’s twin for the EU’s own institutions and agencies, supervised by the European Data Protection Supervisor.

2018 Applies since 11 December 2018

Data Protection Act 2018

The UK’s main data protection statute: it fills in the UK GDPR and covers law enforcement and the intelligence services.

2018 In force since 25 May 2018

Law Enforcement Directive

Directive on data protection in criminal matters

Data protection for the police and criminal justice: when they may collect and use personal data.

2016 National laws since 6 May 2018

Convention 108

Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data

The first binding international treaty on data protection, open to countries outside Europe too. Modernised in 2018 as Convention 108+.

1981 In force since 1 October 1985

ePrivacy Directive

Directive on privacy and electronic communications

Cookies and tracking, marketing emails and calls, and the confidentiality of messages. The cookie consent rule dates from a 2009 amendment.

2002 National laws since 2003

PECR

Privacy and Electronic Communications Regulations 2003

The UK’s cookie and electronic marketing rules, enforced by the ICO.

2003 In force since 11 December 2003

European Health Data Space

European Health Data Space Regulation

Patients’ access to their electronic health records across the EU, and the re-use of health data for research and policy.

2025 Applies in stages from 26 March 2027

Data Act

Who may use the data that connected products and services generate, and the right to switch cloud provider.

2023 Applies since 12 September 2025

Data Governance Act

Re-use of protected public-sector data, neutral data intermediaries, and data shared for the common good (“data altruism”).

2022 Applies since 24 September 2023

Free flow of non-personal data

Regulation on the free flow of non-personal data

Stops national rules that force non-personal data to be stored in one country; the GDPR covers personal data.

2018 Applies since 28 May 2019

Political advertising

Regulation on the transparency and targeting of political advertising

Labels for political ads, and strict limits on targeting them with personal data.

2024 Most rules apply since 10 October 2025

Digital Services Act

Duties for online platforms: illegal content, transparency, and no targeted ads to minors or ads based on sensitive data.

2022 Applies to all platforms since 17 February 2024

Digital Markets Act

Rules for the largest platforms (“gatekeepers”), including consent before they combine personal data across their services.

2022 Applies since 2 May 2023

Cyber Resilience Act

Security requirements for products with digital elements, from smart devices to software.

2024 Main rules apply from 11 December 2027

NIS2

Directive on a high common level of cybersecurity

Cybersecurity duties and incident reporting for essential and important organisations.

2022 National laws from 18 October 2024

DORA

Digital Operational Resilience Act

Digital resilience for the financial sector: ICT risk, incident reporting, testing and outside tech providers.

2022 Applies since 17 January 2025